The Trojan Contact: Konni APT Hijacks KakaoTalk to Turn Victims into Attackers

Konni APT is conducting a sophisticated multi-stage campaign that begins with spear-phishing LNK files which execute PowerShell to deploy decoys and download AutoIt and multiple RATs (EndRAT, RftRAT, RemcosRAT), establishes persistence via a frequent scheduled task, and then abuses compromised KakaoTalk PC sessions to send malicious files to trusted contacts, enabling account-based secondary distribution and broader propagation.